exploit/windows/http/telerik_report_server_deserialization

weaponized

Telerik Report Server Auth Bypass and Deserialization RCE

view exploit source metasploittype exploitpublished 2024-06-04catalog metasploit

exploited CVEs (2)

Known CVEs related to this entry.

ID	severity	EPSS	exploitable	published
CVE-2024-4358US	critical9.8OT critical	97.5% (100th)	KEV	2024-05-29
In Progress Telerik Report Server, version 2024 Q1 (10.0.24.305) or earlier, on IIS, an unauthenticated attacker can gain access to Telerik Report Server restricted functionality v…
CVE-2024-1800US	high8.8	34.2% (98th)	Exploit	2024-03-20
In Progress® Telerik® Report Server versions prior to 2024 Q1 (10.0.24.130), a remote code execution attack is possible through an insecure deserialization vulnerability.

scry

Working exploits like this target internet-facing systems. See what is exposed on your perimeter with a free passive scan.